Add support for org-wide default permissions

endpoints/api.py

@@ -559,7 +559,7 @@ def prototype_view(proto, org_members):
     }
 
   return {
-    'activating_user': prototype_user_view(proto.activating_user),
+    'activating_user': prototype_user_view(proto.activating_user) if proto.activating_user else None,
     'delegate': delegate_view,
     'role': proto.role.name,
     'id': proto.uuid,
@@ -588,7 +588,7 @@ def log_prototype_action(action_kind, orgname, prototype, **kwargs):
   log_params = {
     'prototypeid': prototype.uuid,
     'username': username,
-    'activating_username': prototype.activating_user.username,
+    'activating_username': prototype.activating_user.username if prototype.activating_user else None,
     'role': prototype.role.name
   }
 
@@ -614,6 +614,9 @@ def create_organization_prototype_permission(orgname):
       abort(404)
 
     details = request.get_json()
+    activating_username = None
+
+    if 'activating_user' in details and details['activating_user'] and 'name' in details['activating_user']:
       activating_username = details['activating_user']['name']
     
     delegate = details['delegate']
@@ -623,13 +626,14 @@ def create_organization_prototype_permission(orgname):
     delegate_username = delegate_name if delegate_kind == 'user' else None
     delegate_teamname = delegate_name if delegate_kind == 'team' else None
 
-    activating_user = model.get_user(activating_username)
+    activating_user = (model.get_user(activating_username)
+                       if activating_username else None)
     delegate_user = (model.get_user(delegate_username)
                      if delegate_username else None)
     delegate_team = (model.get_organization_team(orgname, delegate_teamname)
                      if delegate_teamname else None)
 
-    if not activating_user:
+    if activating_username and not activating_user:
       abort(404)
 
     if not delegate_user and not delegate_team:

static/css/quay.css

@@ -54,6 +54,13 @@
   transition: opacity 1s ease-in-out;
 }
 
+.super-option {
+  border: 1px solid #ddd;
+  border-radius: 10px;
+  background: #eee;
+  margin-bottom: 26px;
+}
+
 .small-spinner {
   display: inline-block;
   width: 14px;

static/directives/prototype-manager.html

@@ -16,9 +16,10 @@
     <table class="table">
       <thead>
         <th>
-          <span class="context-tooltip" title="The user that is creating the repository" 
+          <span class="context-tooltip"
+                title="The user or robot that is creating a repository. If '(Organization Default)', then any repository created in this organization will be granted the permission." 
                 bs-tooltip="tooltip.title" data-container="body">
-            Creating User/Robot
+            Repository Creator
           </span>
         </th>
         <th>
@@ -31,9 +32,14 @@
         <th style="width: 150px"></th>
       </thead>
       
-      <tr ng-repeat="prototype in prototypes">
+      <tr ng-repeat="prototype in prototypes | orderBy:comparePrototypes">
         <td>          
-          <span class="entity-reference block-reference" entity="prototype.activating_user" namespace="organization.name"></span>
+          <span class="entity-reference block-reference" entity="prototype.activating_user"
+                namespace="organization.name" ng-show="prototype.activating_user"></span>
+
+          <span ng-show="!prototype.activating_user" style="font-variant: small-caps; font-weight: bold; font-size: 16px;">
+            (Organization Default)
+          </span>
         </td>
         <td>
           <span class="entity-reference block-reference" entity="prototype.delegate" namespace="organization.name"></span>
@@ -60,8 +66,24 @@
           <h4 class="modal-title">Create Default Permission</h4>
         </div>
         <div class="modal-body">
-          <table>
+          <div class="super-option">
+            <table style="width: 100%;">
               <tr>
+                <td>Applies when a repository is created by:</td>
+                <td>
+                  <div class="btn-group btn-group-sm">
+                    <button type="button" class="btn btn-default"
+                            ng-class="newForWholeOrg ? 'active btn-info' : ''" ng-click="setNewForWholeOrg(true)">Anyone</button>
+                    <button type="button" class="btn btn-default"
+                            ng-class="newForWholeOrg ? '' : 'active btn-info'" ng-click="setNewForWholeOrg(false)">A specific user</button>
+                  </div>
+                </td>             
+              </tr>
+            </table>
+          </div>
+
+          <table>
+            <tr ng-show="!newForWholeOrg">
               <td>Creating User/Robot:</td>
               <td>
                 <span class="entity-search" namespace="organization.name" input-title="'Creating User/Robot'"
@@ -88,7 +110,7 @@
           </table>
         </div>
         <div class="modal-footer">         
-          <button ype="button" class="btn btn-primary" ng-disabled="!activatingForNew || !delegateForNew" ng-click="createPrototype()">
+          <button ype="button" class="btn btn-primary" ng-disabled="!(newForWholeOrg || activatingForNew) || !delegateForNew" ng-click="createPrototype()">
             Create Permission
           </button>
           <button type="button" class="btn btn-default" data-dismiss="modal">Close</button>

static/js/app.js

@@ -1524,6 +1524,7 @@ quayApp.directive('prototypeManager', function () {
       $scope.activatingForNew = null;
       $scope.delegateForNew = null;
       $scope.clearCounter = 0;
+      $scope.newForWholeOrg = true;
 
       $scope.roles = [
         { 'id': 'read', 'title': 'Read', 'kind': 'success' },
@@ -1558,15 +1559,24 @@ quayApp.directive('prototypeManager', function () {
         });
       };
 
+      $scope.comparePrototypes = function(p) {
+        return p.activating_user ? p.activating_user.name : ' ';
+      };
+
       $scope.setRoleForNew = function(role) {
         $scope.newRole = role;
       };
 
+      $scope.setNewForWholeOrg = function(value) {
+        $scope.newForWholeOrg = value;
+      };
+
       $scope.showAddDialog = function() {
         $scope.activatingForNew = null;
         $scope.delegateForNew = null;
         $scope.newRole = 'read';
         $scope.clearCounter++;
+        $scope.newForWholeOrg = true;
         $('#addPermissionDialogModal').modal({});
       };
 
@@ -1578,7 +1588,7 @@ quayApp.directive('prototypeManager', function () {
         };
 
         var data = {
-          'activating_user': $scope.activatingForNew,
+          'activating_user': $scope.newForWholeOrg ? null : $scope.activatingForNew,
           'delegate': $scope.delegateForNew,
           'role': $scope.newRole
         };